What is MSS?

Understanding MSS

MSS (Maximum Segment Size) is a TCP option that specifies the largest amount of payload data, in bytes, that a single TCP segment can carry, not counting the TCP and IP headers. Each side advertises its MSS in the SYN packets during the three-way handshake, and the connection uses the lower of the two values to size its segments and avoid fragmentation.

MSS is derived from the path's Maximum Transmission Unit (MTU). On a typical Ethernet link with a 1500-byte MTU, subtracting the standard 20-byte IPv4 header and 20-byte TCP header leaves an MSS of 1460 bytes (it is lower with IPv6's 40-byte header or when options like TCP timestamps are present). By agreeing on MSS up front, both endpoints send segments that fit within the network's frame size, so packets travel intact rather than being broken up and reassembled.

For performance and security, correct MSS handling prevents IP fragmentation, which hurts throughput and can be abused in evasion and denial-of-service attacks where overlapping or tiny fragments confuse firewalls and IDS. Problems often arise across tunnels: VPN and PPPoE encapsulation reduces the usable MTU, and if MSS is not adjusted, large packets with the Don't Fragment bit set get dropped, causing connections that establish but then hang. Network devices commonly apply MSS clamping to rewrite the advertised MSS down to a safe value.

For example, two hosts on Gigabit Ethernet open a TCP connection; both advertise MSS 1460 in their SYNs, so each sends up to 1460 bytes of data per segment, neatly filling 1500-byte frames. Later, traffic for the same application crosses an IPsec VPN that adds overhead and lowers the effective MTU to 1400. A router on the tunnel performs MSS clamping, rewriting the SYN's MSS to 1360 so segments fit through the tunnel without fragmentation, resolving stalled file transfers. MSS is a common topic on CompTIA Network+ and Cisco exams.